onyx

onyx --cves cve-2019-11043

CVE-2019-11043

N/AKEVNUCLEI ↗PHP
score
<0.1
cvss
—
epss
99.7%
published
—
kev added
2022-03-25
first seen

In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2022-03-25 — Added to CISA KEVK2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Nuclei template: PHP-FPM Path Info Buffer Underflow - Remote Code ExecutionNscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 99.8%2026-09-23: epss 99.8%2026-09-24: epss 99.8%2026-09-25: epss 99.8%2026-09-26: epss 99.8%2026-09-27: epss 99.8%2026-09-28: epss 99.8%2026-09-29: epss 99.8%2026-09-30: epss 99.8%2026-10-01: epss 99.8%2026-10-02: epss 99.8%2026-10-03: epss 99.8%2026-10-04: epss 99.8%2026-10-05: epss 99.8%2026-10-06: epss 99.8%2026-10-07: epss 99.8%2026-10-08: epss 99.8%2026-10-09: epss 99.8%2026-10-10: epss 99.8%2026-10-11: epss 99.8%2026-10-12: epss 99.8%2026-10-13: epss 99.7%2026-10-14: epss 99.7%2026-10-15: epss 99.7%2026-10-16: epss 99.7%2026-10-18: epss 99.7%2026-10-19: epss 99.7%2026-10-20: epss 99.7%2026-10-21: epss 99.7%99.7%mentions/day0no mentions in 30 days2026-09-22today
  1. Added to CISA KEV
  2. Tracked by Onyx
  3. Nuclei template PHP-FPM Path Info Buffer Underflow - Remote Code Execution

Nuclei template

A verified check exists — you can scan for this today, and so can everyone else.

template
PHP-FPM Path Info Buffer Underflow - Remote Code Execution
severity
CRIT
first seen
nuclei -id CVE-2019-11043 -u https://target.example

Weaknesses

CWE-120

References 1